Legal

Privacy Policy

Effective date: April 1, 2026

This Privacy Policy describes how Thackeray Media LLC doing business as Go Clinch("Go Clinch," "we," "us," or "our") collects, uses, and shares information when you use our mobile and web application (the "Service").

1. Information We Collect

Information you provide directly:

• Account information: Your email address, name, and optionally your phone number when you create an account.
• Task data: The titles of tasks you create, stake amounts you select, deadlines you set, and completion status you report.
• Payment information: We store only a Stripe Customer ID and Payment Intent IDs — identifiers that let us communicate with Stripe. We never store, see, or have access to your full card number, expiration date, or CVV. Stripe handles all raw payment data under PCI DSS compliance.
• Passkeys / authentication credentials: If you register a passkey (WebAuthn credential), we store the public key credential ID and associated metadata. We do not store your biometric data — that stays on your device.
• Communications: If you contact us for support, we retain that correspondence.

Information collected automatically:

• Push notification tokens: If you grant permission, we store a push subscription endpoint and cryptographic keys (from your browser/device) to deliver reminders. These do not identify you beyond being associated with your account.
• Usage data: Streak counts, completion rates, and task statistics to power your history and motivational messages.
• Log data: IP address, browser type, and timestamps, collected by our hosting provider (Vercel) for operational and security purposes. These are retained for a limited time and are not linked to your account in our primary database.

Information we do NOT collect:

• Advertising identifiers
• Location data beyond IP-level country/region
• Contacts, photos, or other device data
• Social media profile information
• Biometric data (your passkey stays on your device)

2. How We Use Your Information

We use your information only to:

• Create and manage your account and authenticate you securely;
• Process payment authorizations and captures through Stripe;
• Track your daily task commitments and resolve them at your deadline;
• Send you push notifications before your deadline (only if you grant permission);
• Display your history, streaks, and statistics;
• Respond to your support requests;
• Detect and prevent fraud, abuse, or unauthorized access;
• Comply with legal obligations; and
• Improve and operate the Service.

We do not use your task titles or personal data for advertising, profiling, or any purpose other than operating the Service for you.

3. Legal Basis for Processing (where applicable)

We process your personal data on the following bases:

• Contract performance: Processing your account, tasks, and payments is necessary to fulfill our agreement with you.
• Legitimate interests: Security monitoring, fraud prevention, and service improvement, where these interests are not overridden by your rights.
• Consent: Push notifications, where you have explicitly granted permission (you can revoke this at any time in your device settings).
• Legal obligation: Where required by law.

4. How We Share Your Information

We do not sell, rent, or trade your personal information. We share data only with the following categories of recipients and only as necessary:

We may also disclose your information if required by law, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to protect our rights, prevent fraud, or protect the safety of any person.

In the event of a merger, acquisition, or sale of all or substantially all of our assets, your information may be transferred to the acquiring entity. We will notify you of any such transfer and any changes to this Privacy Policy.

5. Data Retention

We retain your data for as long as your account is active, plus:

• Task and financial records: Retained for a minimum of 3 years after resolution to comply with financial recordkeeping obligations and to handle any disputes.
• Account data: Deleted within 90 days of a verified account deletion request, except where retention is required by law.
• Server logs: Retained for up to 90 days by Vercel for security and operational purposes.
• Push notification tokens: Deleted when you revoke notification permission or when the subscription becomes invalid (as reported by the push service).

To request deletion of your account and associated data, contact us at support@goclinch.app. We will process verified deletion requests within 30 days, subject to any legal retention obligations.

6. Security

We implement technical and organizational measures to protect your information, including:

• TLS encryption for all data in transit;
• Encryption at rest for data stored in our database;
• Row-level security (RLS) in our database, ensuring each user can only access their own data;
• Scoped API access controls and rate limiting;
• No storage of raw payment card data — delegated entirely to Stripe;
• VAPID-keyed push notifications, which are not interceptable without both server and device keys.

No security measure is perfect. In the event of a data breach affecting your personal information, we will notify you as required by applicable law.

7. Your Rights and Choices

All users:

• Access and correction: You can view and update your account information in the app settings.
• Push notifications: You can revoke notification permission at any time in your browser or device settings.
• Account deletion: Contact us at support@goclinch.app to delete your account and personal data.

California residents (CCPA / CPRA):

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

• Right to know: You may request a copy of the personal information we have collected about you, the categories of sources, our business purpose for collecting it, and the categories of third parties we share it with.
• Right to deletion: You may request deletion of your personal information, subject to certain exceptions.
• Right to correct: You may request correction of inaccurate personal information.
• Right to opt out of sale: We do not sell personal information, and we do not share it for cross-context behavioral advertising. No opt-out is necessary.
• Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise any of these rights, contact us at support@goclinch.app. We will respond within 45 days. We may need to verify your identity before processing your request.

8. Children's Privacy

The Service is intended only for users who are 18 years of age or older. We do not knowingly collect personal information from children under 18. If you believe a minor has provided us with personal information, please contact us at support@goclinch.appand we will take steps to delete it.

9. Cookies and Similar Technologies

We use session cookies and local/session storage to maintain your authenticated session and to remember UI preferences (such as whether you've seen the intro splash). We do not use third-party advertising cookies or tracking pixels.

You can configure your browser to block or delete cookies, but doing so may prevent certain features of the Service from functioning correctly.

10. Third-Party Links

The Service may contain links to third-party websites or services (such as Stripe's hosted pages). We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing any personal information.

11. International Users

The Service is operated in the United States and is intended for U.S. residents only. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country. By using the Service, you consent to this transfer.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the effective date above and, where appropriate, by email or in-app notification. Your continued use of the Service after the changes take effect constitutes your acceptance of the updated policy. If you do not agree, you must stop using the Service and request account deletion.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at:

We will respond to all verifiable requests within 30 days, or within the time period required by applicable law.